Every CVE phpwarden knows about across the PHP engine, Composer packages and WordPress plugins, themes and core — ranked by real-world exploitation. Feed 2026.10.29.4, updated 2026-10-29. Browse by package.
| CVE | Package | Title | Severity | CVSS | EPSS |
|---|---|---|---|---|---|
| CVE-2024-1862 | woocommerce-add-to-cart-custom-redirect (WordPress plugin) | The WooCommerce Add to Cart Custom Redirect plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to | high | 8.1 | 1% |
| CVE-2021-4350 | frontend-file-manager-plugin (WordPress plugin) | The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated HTML Injection in versions up to, and including, 18.2. This | high | 7.2 | 1% |
| CVE-2021-24633 | countdown-block (WordPress plugin) | The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authen | medium | 4.3 | 1% |
| CVE-2024-6328 | mstore-api (WordPress plugin) | The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions u | critical | 9.8 | 1% |
| CVE-2023-6327 | woolentor-addons (WordPress plugin) | The ShopLentor (formerly WooLentor) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on t | medium | 5.3 | 1% |
| CVE-2021-39347 | woo-stripe-payment (WordPress plugin) | The Stripe for WooCommerce WordPress plugin is missing a capability check on the save() function found in the ~/includes/admin/class-wc-stri | medium | 4.3 | 1% |
| CVE-2023-5425 | post-meta-data-manager (WordPress plugin) | The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the | high | 8.8 | 1% |
| CVE-2023-2434 | wp-nested-pages (WordPress plugin) | The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function i | low | 3.8 | 1% |
| CVE-2022-40316 | moodle/moodle | Moodle No groups filtering in H5P activity attempts report | medium | 4.3 | 1% |
| CVE-2021-4371 | wp-quick-front-end-editor (WordPress plugin) | The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to Setting Changs in versions up to, and including, 5.5. This is due to lack | medium | 4.3 | 1% |
| CVE-2021-34648 | ninja-forms (WordPress plugin) | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Rout | medium | 6.4 | 1% |
| CVE-2021-4348 | ultimate-gdpr-\&-ccpa-compliance-toolkit (WordPress plugin) | The Ultimate GDPR & CCPA plugin for WordPress is vulnerable to unauthenticated settings import and export via the export_settings & import_s | high | 7.5 | 1% |
| CVE-2021-4347 | advanced-shipment-tracking-for-woocommerce (WordPress plugin) | The function update_shipment_status_email_status_fun in the plugin Advanced Shipment Tracking for WooCommerce in versions up to 3.2.6 is vul | critical | 9.9 | 1% |
| CVE-2023-0890 | shortcodes-ultimate (WordPress plugin) | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not ensure that posts to be displayed via some sho | medium | 6.5 | 1% |
| CVE-2023-0911 | shortcodes-ultimate (WordPress plugin) | The WordPress Shortcodes Plugin — Shortcodes Ultimate WordPress plugin before 5.12.8 does not validate the user meta to be retrieved via the | medium | 6.5 | 1% |
| CVE-2023-1371 | w4-post-list (WordPress plugin) | The W4 Post List WordPress plugin before 2.4.6 does not ensure that password protected posts can be accessed before displaying their content | medium | 6.5 | 1% |
| CVE-2024-1043 | accelerated-mobile-pages (WordPress plugin) | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check | medium | 6.5 | 1% |
| CVE-2025-46348 | yeswiki/yeswiki | YesWiki Vulnerable to Unauthenticated Site Backup Creation and Download | critical | 10.0 | 1% |
| CVE-2021-25084 | advanced-cron-manager (WordPress plugin) | The Advanced Cron Manager WordPress plugin before 2.4.2 and Advanced Cron Manager Pro WordPress plugin before 2.5.3 do not have authorisatio | medium | 4.3 | 1% |
| CVE-2023-6383 | debug-log-manager (WordPress plugin) | The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download | high | 7.5 | 1% |
| CVE-2021-24500 | workreap (WordPress plugin) | Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct obj | high | 8.1 | 1% |
| CVE-2022-4937 | wc-frontend-manager (WordPress plugin) | The WCFM Frontend Manager plugin for WordPress is vulnerable to unauthorized modification and access of data in versions up to, and includin | medium | 6.3 | 1% |
| CVE-2023-5054 | super-store-finder (WordPress plugin) | The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and inclu | medium | 5.8 | 1% |
| CVE-2023-2351 | wpdirectorykit (WordPress plugin) | The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability ch | medium | 6.5 | 1% |
| CVE-2026-8237 | concrete5/concrete5 | Concrete CMS is vulnerable to IDOR | medium | 0.0 | 1% |
| CVE-2022-0179 | snipe/snipe-it | Incorrect Default Permissions and Improper Access Control in snipe-it | medium | 5.4 | 1% |
| CVE-2023-2299 | meeting-scheduler-by-vcita (WordPress plugin) | The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via th | medium | 5.3 | 1% |
| CVE-2023-5533 | chatbot (WordPress plugin) | The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding | medium | 5.3 | 1% |
| CVE-2026-45260 | pimcore/pimcore | Pimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling | high | 8.1 | 1% |
| CVE-2021-24635 | visual-link-preview (WordPress plugin) | The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displaye | medium | 5.4 | 1% |
| CVE-2021-4366 | pwa-for-wp-\&-amp (WordPress plugin) | The PWA for WP & AMP plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the pwaforwp_update_fe | medium | 6.3 | 1% |
| CVE-2024-10008 | learning-management-system (WordPress plugin) | The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modifi | high | 8.8 | 1% |
| CVE-2025-2025 | give (WordPress plugin) | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to unauthorized access of data due to a missing cap | medium | 6.5 | 1% |
| CVE-2024-10802 | hash-elements (WordPress plugin) | The Hash Elements plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the hash_elements_g | medium | 5.3 | 1% |
| CVE-2023-1843 | metform (WordPress plugin) | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to unauthorized permalink structure update due to a missing ca | medium | 6.5 | 1% |
| CVE-2020-15245 | sylius/sylius | Ability to switch customer email address on account detail page and stay verified | medium | 4.3 | 1% |
| CVE-2019-15648 | insert-or-embed-articulate-content-into-wordpress (WordPress plugin) | The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renam | medium | 6.5 | 1% |
| CVE-2024-2543 | permalink-manager-lite (WordPress plugin) | The Permalink Manager Lite plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'get_u | medium | 4.3 | 1% |
| CVE-2024-7031 | filester (WordPress plugin) | The File Manager Pro – Filester plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on | high | 7.5 | 1% |
| CVE-2022-0837 | amelia (WordPress plugin) | The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send | medium | 5.4 | 1% |
| CVE-2021-4338 | 404-to-301 (WordPress plugin) | The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redir | medium | 6.4 | 1% |
| CVE-2024-6660 | bookingpress-appointment-booking (WordPress plugin) | The BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modif | high | 8.8 | 1% |
| CVE-2023-1868 | yourchannel (WordPress plugin) | The YourChannel plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check when clearing the plugin c | medium | 6.5 | 1% |
| CVE-2024-6088 | learnpress (WordPress plugin) | The LearnPress – WordPress LMS Plugin plugin for WordPress is vulnerable to unauthorized user registration due to a missing capability check | medium | 5.3 | 1% |
| CVE-2024-3607 | propertyhive (WordPress plugin) | The PropertyHive plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the delete_key_date() | medium | 4.3 | 1% |
| CVE-2024-11334 | my-contador-wp (WordPress plugin) | The My Contador lesr plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportar_reg | medium | 4.3 | 1% |
| CVE-2023-6048 | estatik (WordPress plugin) | The Estatik Real Estate Plugin WordPress plugin before 4.1.1 does not prevent user with low privileges on the site, like subscribers, from s | medium | 6.5 | 1% |
| CVE-2023-4637 | wpvivid-backuprestore (WordPress plugin) | The WPvivid plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the restore() and get_res | medium | 4.3 | 1% |
| CVE-2023-2085 | essential-blocks (WordPress plugin) | The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the templa | medium | 4.3 | 1% |
| CVE-2023-4668 | ad-inserter (WordPress plugin) | The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-proc | medium | 5.3 | 1% |